Five Tips for the CISO in 2017

The new year is here, and with it comes another fresh wave of attacks, continued strain on resources and the hubbub of everyone returning to the office after a long, much-needed break. The chief information security officer’s (CISO’s) time is as stretched as it has ever been and, most likely, so is his or her attention span. Here’s a short list of priorities for CISOs to keep running in the background.

1. Find Your Flow

No matter what you do, do it because it drives you and fills you with energy and motivation. Do the thing that causes you to radiate like the sun. Sure, cybersecurity can have its share of doom and gloom, but helping your organization navigate through cyber risks should be a positive, rewarding task.

In December 2016, Inc. Magazine published a list of must-read books for the end of the year. The most notable for our purposes is “Born for This: How to Find the Work You Were Meant to Do” by Chris Guillebeau. The book promises to help you find your flow — that thing that you do really well that makes time stand still.

2. Align With Business Objectives

It is critical for the CISO to spend the time to learn, understand and fully align with the organization’s business objectives. Cyber risks do not exist in a vacuum. These risks must be translated in the context of their impact on the organization’s ability to achieve its business objectives.

Cyber risks aren’t always obvious, however. Just look at the impending Internet of Things (IoT) security mess heading our way. The CISO must gauge the level of awareness and understanding among the organization’s top leadership and connect the dots to ensure executives and board directors make appropriate, risk-informed decisions.

3. Improve Your Selling and Influencing Capabilities

The CISO’s role is complex, subtle and constantly changing. The good news is that most CISOs have abandoned scare tactics. Instead, they’ve turned to cyber risk quantification and maturity scales, all while continuing to use compliance as a main driver. But CISOs should put their people skills to use and complement these traditional methods with a softer approach.

CISOs should know by now that their role requires the ability to influence with little to no authority. Another book from the Inc. Magazine list, “Pre-Suasion: A Revolutionary Way to Influence and Persuade” by Robert Cialdini, can help you grow your circle of influence. While this book is aimed at sales professionals, security leaders can still get lots of value from it.

4. Counsel Top Leadership

According to Deloitte, CISOs should act as strategists and advisers. This means that they must drive business and cyber risk strategy alignment, instigate transformational change to manage risk, and educate, advise and influence activities with cyber risk implications. CISOs are often distracted from these duties by their additional responsibilities as guardians and technologists.

Listen to the podcast: Directors Are From Mars, CISOs Are From Venus

Now more than ever, CISOs must act as strategic advisers to their organizations, top executives and boards of directors, communicating frequently and effectively. This comes easily, almost innately, to some CISOs. Others struggle to communicate, due either to unfamiliarity with the territory or an organizational culture that still views the role as a limited, narrow position. Angela Duckworth’s “Grit: The Power of Passion and Perseverance” can help more timid CISOs develop the voice they need to drive a culture of security.

As the saying goes, however, doing the same thing over and over and expecting different results isn’t a good strategy. The CISO should seek a trusted mentor to help him or her set aside preconceived assumptions and limitations.

5. Be Strategic About Your Professional Development

If you don’t keep moving forward and upward, your value to your organization will diminish. A CISO cannot afford to stand still and must think strategically about professional development. CISOs should force themselves to set aside time, determine and clarify next steps, invest in deep work and build their external reputations.

As expected, according to Hunt Scanlon Media, the CISO position continues to be in high demand. The security officer’s role is mentioned alongside other technology roles such as head of IoT strategy, chief data officer and chief digital officer. If you think you’re ready for a switch, go deep to explore what executive talent recruiters are looking for.